Context-Based File Block Classification

Abstract : Because files are typically stored as sequences of data blocks, the file carving process in digital forensics involves the identification and collocation of the original blocks of files. Current file carving techniques that use the signatures of file headers and footers could be improved by first classifying each data block in the storage media as belonging to a given file type. Unfortunately, file block classification techniques tend to have low accuracy. One reason is that they do not account for compound files that contain subcomponents encoded as different data types. This paper presents a context-based classification approach that accounts for compound files and improves on block-by-block classification schemes by exploiting the contiguity of file blocks belonging to the same file on the storage media.
Type de document :
Communication dans un congrès
Gilbert Peterson; Sujeet Shenoi. 8th International Conference on Digital Forensics (DF), Jan 2012, Pretoria, South Africa. Springer, IFIP Advances in Information and Communication Technology, AICT-383, pp.67-82, 2012, Advances in Digital Forensics VIII. 〈10.1007/978-3-642-33962-2_5〉
Liste complète des métadonnées

https://hal.inria.fr/hal-01523720
Contributeur : Hal Ifip <>
Soumis le : mardi 16 mai 2017 - 17:10:29
Dernière modification le : dimanche 28 janvier 2018 - 09:24:01
Document(s) archivé(s) le : vendredi 18 août 2017 - 00:25:16

Fichier

978-3-642-33962-2_5_Chapter.pd...
Fichiers produits par l'(les) auteur(s)

Licence


Distributed under a Creative Commons Paternité 4.0 International License

Identifiants

Citation

Luigi Sportiello, Stefano Zanero. Context-Based File Block Classification. Gilbert Peterson; Sujeet Shenoi. 8th International Conference on Digital Forensics (DF), Jan 2012, Pretoria, South Africa. Springer, IFIP Advances in Information and Communication Technology, AICT-383, pp.67-82, 2012, Advances in Digital Forensics VIII. 〈10.1007/978-3-642-33962-2_5〉. 〈hal-01523720〉

Partager

Métriques

Consultations de la notice

79

Téléchargements de fichiers

45